Stopping hotlinking from a directory using web.config

Question

I have a folder on my site for caching large flash movies and I want to stop other people from embedding them in their site; I would like to try and do this using the web.config file only. How could this be done?

My first attempt at a rule (which doesn't work):

The following rule was supposed to prevent public access (and embedding) to .swf files in the cache folder 'CurrentCache' - http://myurl.com/ContentCache/ and give a replacement movie 'NoEmbedFromCacheSWF.swf' instead.

<rule name="Prevent SWF hotlinking" enabled="true">
      <match url="^(ContentCache)(.swf)$" ignoreCase="true" />
      <conditions>
        <add input="{HTTP_REFERER}" pattern="^http://(.*\.)?myurl\.com/.*$" negate="true" />
      </conditions>
      <action type="Rewrite" url="/Content/Flash/NoEmbedFromCacheSWF.swf" />
    </rule>

Thanks in advance!

Note: I think I have got the regex wrong in the <match url="A swf inside /ContentCache/" ignoreCase="true" /> line, any ideas what it should?

Answer 1

You can build an HttpModule for this. There is a blog posting describing exactly what you want to do I think:

HttpModule to block external referrers in ASP.NET

Edit: Of course I'm bending the rules here about web.config only. You have to use an external module, but then you can use it referencing from web.config only without modifying any of your code.

Edit2: If you want to do it using a rewrite rule, you have to change your pattern, like this:

<rule name="Prevent SWF hotlinking" enabled="true">   
  <match url="/ContentCache/.*\.swf$" ignoreCase="true" />   
  <conditions>   
    <add input="{HTTP_REFERER}" pattern="^http://(.*\.)?myurl\.com/.*$" negate="true" />   
  </conditions>   
  <action type="Rewrite" url="/Content/Flash/NoEmbedFromCacheSWF.swf" />   
</rule>  

The pattern used is a regular expression, you can read up on them here and you can test them for example on this webpage.